Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <2f60dbb0-c350-73a1-fd55-b468ec8a0707@bytedance.com>
Date:   Wed, 8 Jun 2022 11:06:45 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.9.1
Subject: Re: Re: [PATCH] mm/memory-failure: don't allow to unpoison hw
 corrupted page
Content-Language: en-US
To:     =?UTF-8?B?SE9SSUdVQ0hJIE5BT1lBKOWggOWPoyDnm7TkuZ8p?= 
        <naoya.horiguchi@nec.com>,
        Andrew Morton <akpm@linux-foundation.org>
Cc:     David Hildenbrand <david@redhat.com>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Tony Luck <tony.luck@intel.com>,
        Wu Fengguang <fengguang.wu@intel.com>
References: <20220604103229.3378591-1-pizhenwei@bytedance.com>
 <20220604115616.b7d5912ac5a37db608f67b78@linux-foundation.org>
 <584eedd3-9369-9df1-39e2-62e331abdcc0@bytedance.com>
 <20220606043202.GA1328953@hori.linux.bs1.fc.nec.co.jp>
 <3b58adbf-a8b2-8dba-71a7-123ba3850c10@bytedance.com>
 <20220606091503.GA1337789@hori.linux.bs1.fc.nec.co.jp>
 <5e7abb3f-56e7-0343-a678-749b6f5238a2@redhat.com>
 <20220607145959.785e54c752f373bcc283732b@linux-foundation.org>
 <20220607234306.GA1400839@hori.linux.bs1.fc.nec.co.jp>
From:   zhenwei pi <pizhenwei@bytedance.com>
In-Reply-To: <20220607234306.GA1400839@hori.linux.bs1.fc.nec.co.jp>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk


On 6/8/22 07:43, HORIGUCHI NAOYA(堀口 直也) wrote:
> On Tue, Jun 07, 2022 at 02:59:59PM -0700, Andrew Morton wrote:
>> On Tue, 7 Jun 2022 14:36:00 +0200 David Hildenbrand <david@redhat.com> wrote:
>>
>>> On 06.06.22 11:15, HORIGUCHI NAOYA(堀口 直也) wrote:
>>>>>>     [  917.864266]  <TASK>
>>>>>>     [  917.864961]  clear_huge_page+0x147/0x270
>>>>>>     [  917.866236]  hugetlb_fault+0x440/0xad0
>>>>>>     [  917.867366]  handle_mm_fault+0x270/0x290
>>>>>>     [  917.868532]  do_user_addr_fault+0x1c3/0x680
>>>>>>     [  917.869768]  exc_page_fault+0x6c/0x160
>>>>>>     [  917.870912]  ? asm_exc_page_fault+0x8/0x30
>>>>>>     [  917.872082]  asm_exc_page_fault+0x1e/0x30
>>>>>>     [  917.873220] RIP: 0033:0x7f2aeb8ba367
>>>>>>
>>>>>> I don't think of a workaround for this now ...
>>>>>>
>>>>>
>>>>> Could you please tell me how to reproduce this issue?
>>>>
>>>> You are familiar with qemu-monitor-command, so the following procedure
>>>> should work for you:
>>>>
>>>>    - run a process using hugepages on your VM,
>>>>    - check the guest physical address of the hugepage (page-types.c is helpful for this),
>>>>    - inject a MCE with virsh qemu-monitor-command on the guest physical address, then
>>>>    - unpoison the injected physical address.
>>>
>>> That's triggered via debugfs / HWPOISON_INJECT, right?
>>>
>>> That's a DEBUG_KERNEL option, so I'm not 100% sure if we really want to
>>> cc stable.
> 
> Sure, the impact of the bug is limited.
> 
>>
>> Sure, it's hardly a must-have.  But let's also take the patch
>> complexity&risk into account.  This is one dang simple patch.
>>
>> Or is it.  Should these things be happening outside mf_mutex?  What the
>> heck is the role of mf_mutex anyway?
> 
> mf_mutex is to ensure that only one error handling thread can handle
> the pfn at one time, but set_mce_nospec() is called outside it now.
> So if we want to prevent the race with unmap, both of set_mce_nospec()
> and the new kpte check might need to be done in mf_mutex.
> 
> - Naoya Horiguchi

OK, I'll sent a v2 patch which includes:
- this change gets protected by mf_mutex
- use -EOPNOTSUPP instead of -EPERM

By the way, I assume that the similar trace(provided by Naoya) is not a 
same issue. It seems undissolved huge page with corrupted KPTE. I'm 
trying to fix it ...

-- 
zhenwei pi